About the news
Several large banks, including Citi and Bank of America, have joined earlier moves by other institutions. Outside AI agents are limited from logging into customer accounts or starting transactions without human approval. The rules aim to keep control with the account holder and reduce risks around unauthorized access, liability, and automated actions that could go wrong.
At the same time, more websites are blocking or limiting automated agent access. Site operators are responding to agents that browse, scrape, or act on their platforms without clear human oversight.
Key points from the coverage:
- Banks are drawing a clear line: agents may assist users, but they should not independently access accounts or move money
- Websites are adding technical and policy limits on automated agents
- The steps reflect rising concern about security, liability, and control as agents gain the ability to act across systems
Why it matters
The pattern is practical rather than theoretical. Technical capability is advancing quickly. Institutional willingness to grant agents broad autonomous access is not keeping pace. For anyone building or deploying agents that touch money, accounts, or third-party sites, these limits are becoming part of the operating environment.
